Branch unprotection restriction starting point

Explored Policy framework to create something I can use as a starting point.

1 files changed, 15 insertions, 0 deletions

diff --git a/app/policies/protected_branch_policy.rb b/app/policies/protected_branch_policy.rb
new file mode 100644
index 00000000000..8d44cff1b42
--- /dev/null
+++ b/app/policies/protected_branch_policy.rb
@@ -0,0 +1,15 @@
+class ProtectedBranchPolicy < BasePolicy
+  delegate { @subject.project }
+
+  condition(:requires_admin_to_unprotect?, scope: :subject) do
+    @subject.name == 'master' && Gitlab::CurrentSettings.only_admins_can_unprotect_master_branch?
+  end
+
+  rule { can?(:admin_project) }.policy do
+    enable :update_protected_branch
+  end
+
+  rule { requires_admin_to_unprotect? & ~admin }.policy do
+    prevent :update_protected_branch
+  end
+end